Hi all I have been trying to work out the way define multiple processors based on a group of conditions. The below snippet doesn't seem to be working but hopefully it will give you an idea of what I am trying to accomplish.
# winlogbeat.yml processors: - when.and: - equals.event.module: "sysmon" - equals.winlog.event_id: 1 - equals.user.id: "S-1-5-18" # if the above conditions are met then run the following processors # processor01 - drop_event.when.and: - equals.process.executable: "C:\\Windows\\System32\\smss.exe" - equals.process.parent.executable: "C:\\Windows\\System32\\smss.exe" # processor02 - drop_event.when.and: - equals.process.parent.executable: "C:\\Windows\\System32\\smss.exe" - or: - equals.process.command_line: "%%SystemRoot%%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" - equals.process.command_line: "%%SystemRoot%%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" # processor03 ...
The documentation details how do define conditions within the processor itself:
processors: - <processor_name>: when: <condition> <parameters>
but I am trying to first define some conditions before even defining the processor.
I couldn't find the guide on how to used the an AND/OR statement inside an IF statement in the processors documentation so I guess it's acheiveable with a when statement? Not sure if that is even supported. Let me know if there is best/supported way to accomplish this. I essentially want want to define multiple processors but based on multiple conditions. I know I can define the original conditions directly under the processor but there will be tens of those processors so I want to cut down in the number of lines and make it easier to read/update.
Any help will be appreciated.